DO NOT SUBMIT: switch to an on-heap stack for nested object serialization/deserialization

src/value-serializer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/value-serializer.h"
 
 #include <type_traits>
 
 #include "src/base/logging.h"
 #include "src/conversions.h"
@@ skipping 106 matching lines @@
   kUint16Array = 'W',
   kInt32Array = 'd',
   kUint32Array = 'D',
   kFloat32Array = 'f',
   kFloat64Array = 'F',
   kDataView = '?',
 };
 
 }  // namespace
 
+struct ValueSerializer::State {
+  enum Kind {
+    kJSObjectPropertiesSlow,
+    kDenseArrayElementsSlow,
+    kDenseArrayPropertiesSlow,
+    kSparseArrayPropertiesSlow,
+    kJSMap,
+    kJSSet,
+  };
+  Kind kind;
+  uint32_t index;
+  uint32_t array_length;
+  uint32_t properties_written;
+  Handle<JSObject> receiver;
+  Handle<FixedArray> data;
+};
+
 ValueSerializer::ValueSerializer(Isolate* isolate)
     : isolate_(isolate),
       zone_(isolate->allocator()),
       id_map_(isolate->heap(), &zone_),
-      array_buffer_transfer_map_(isolate->heap(), &zone_) {}
+      array_buffer_transfer_map_(isolate->heap(), &zone_),
+      states_(&zone_) {}
 
 ValueSerializer::~ValueSerializer() {}
 
 void ValueSerializer::WriteHeader() {
   WriteTag(SerializationTag::kVersion);
   WriteVarint(kLatestVersion);
 }
 
 void ValueSerializer::WriteTag(SerializationTag tag) {
   buffer_.push_back(static_cast<uint8_t>(tag));
@@ skipping 60 matching lines @@
   buffer_.resize(buffer_.size() + bytes);
   return &buffer_[old_size];
 }
 
 void ValueSerializer::TransferArrayBuffer(uint32_t transfer_id,
                                           Handle<JSArrayBuffer> array_buffer) {
   DCHECK(!array_buffer_transfer_map_.Find(array_buffer));
   array_buffer_transfer_map_.Set(array_buffer, transfer_id);
 }
 
-Maybe<bool> ValueSerializer::WriteObject(Handle<Object> object) {
+Maybe<bool> ValueSerializer::WriteObject(Handle<Object> outer_object) {
+  size_t stack_size = states_.size();
+  if (!WriteObjectInternal(outer_object).FromMaybe(false)) {
+    return Nothing<bool>();
+  }
+  while (states_.size() > stack_size) {
+    // Warning: it is illegal to access |state| after invoking
+    // WriteObjectInternal, because the vector may have reallocated.
+    size_t state_index = states_.size() - 1;
+    State& state = states_[state_index];
+
+    switch (state.kind) {
+      case State::kJSObjectPropertiesSlow:
+      case State::kDenseArrayPropertiesSlow:
+      case State::kSparseArrayPropertiesSlow: {
+        Handle<FixedArray> keys = state.data;
+        if (state.index >= keys->length()) {
+          DCHECK_EQ(state.index, keys->length());
+          if (state.kind == State::kJSObjectPropertiesSlow) {
+            WriteTag(SerializationTag::kEndJSObject);
+            WriteVarint<uint32_t>(state.properties_written);
+          } else if (state.kind == State::kDenseArrayPropertiesSlow) {
+            WriteTag(SerializationTag::kEndDenseJSArray);
+            WriteVarint<uint32_t>(state.properties_written);
+            WriteVarint<uint32_t>(state.array_length);
+          } else if (state.kind == State::kSparseArrayPropertiesSlow) {
+            WriteTag(SerializationTag::kEndSparseJSArray);
+            WriteVarint<uint32_t>(state.properties_written);
+            WriteVarint<uint32_t>(state.array_length);
+          }
+          states_.pop_back();
+          continue;
+        }
+
+        Handle<Object> key(keys->get(state.index++), isolate_);
+        bool success;
+        LookupIterator it = LookupIterator::PropertyOrElement(
+            isolate_, state.receiver, key, &success, LookupIterator::OWN);
+        DCHECK(success);
+        Handle<Object> value;
+        if (!Object::GetProperty(&it).ToHandle(&value)) return Nothing<bool>();
+
+        // If the property is no longer found, do not serialize it.
+        // This could happen if a getter deleted the property.
+        if (!it.IsFound()) continue;
+
+        if (!WriteObjectInternal(key).FromMaybe(false)) return Nothing<bool>();
+        DCHECK_EQ(states_.size(), state_index + 1);
+        if (!WriteObjectInternal(value).FromMaybe(false)) {
+          return Nothing<bool>();
+        }
+        states_[state_index].properties_written++;
+        break;
+      }
+      case State::kDenseArrayElementsSlow: {
+        if (state.index >= state.array_length) {
+          DCHECK_EQ(state.index, state.array_length);
+          state.kind = State::kDenseArrayPropertiesSlow;
+          state.index = 0;
+          continue;
+        }
+        LookupIterator it(isolate_, state.receiver, state.index++,
+                          state.receiver, LookupIterator::OWN);
+        Handle<Object> element;
+        if (!Object::GetProperty(&it).ToHandle(&element) ||
+            !WriteObjectInternal(element).FromMaybe(false)) {
+          return Nothing<bool>();
+        }
+        break;
+      }
+      case State::kJSMap:
+      case State::kJSSet: {
+        Handle<FixedArray> collection = state.data;
+        if (state.index >= collection->length()) {
+          DCHECK_EQ(state.index, collection->length());
+          WriteTag(state.kind == State::kJSMap ? SerializationTag::kEndJSMap
+                                               : SerializationTag::kEndJSSet);
+          WriteVarint<uint32_t>(collection->length());
+          states_.pop_back();
+          continue;
+        }
+        Handle<Object> value(collection->get(state.index++), isolate_);
+        if (!WriteObjectInternal(value).FromMaybe(false)) {
+          return Nothing<bool>();
+        }
+        break;
+      }
+    }
+  }
+  DCHECK_EQ(states_.size(), stack_size);
+  return Just(true);
+}
+
+Maybe<bool> ValueSerializer::WriteObjectInternal(Handle<Object> object) {
   if (object->IsSmi()) {
     WriteSmi(Smi::cast(*object));
     return Just(true);
   }
 
   DCHECK(object->IsHeapObject());
   switch (HeapObject::cast(*object)->map()->instance_type()) {
     case ODDBALL_TYPE:
       WriteOddball(Oddball::cast(*object));
       return Just(true);
@@ skipping 113 matching lines @@
 
   // Eliminate callable and exotic objects, which should not be serialized.
   InstanceType instance_type = receiver->map()->instance_type();
   if (receiver->IsCallable() || instance_type <= LAST_SPECIAL_RECEIVER_TYPE) {
     return Nothing<bool>();
   }
 
   // If we are at the end of the stack, abort. This function may recurse.
   if (StackLimitCheck(isolate_).HasOverflowed()) return Nothing<bool>();
 
-  HandleScope scope(isolate_);
   switch (instance_type) {
     case JS_ARRAY_TYPE:
       return WriteJSArray(Handle<JSArray>::cast(receiver));
     case JS_OBJECT_TYPE:
     case JS_API_OBJECT_TYPE:
       return WriteJSObject(Handle<JSObject>::cast(receiver));
     case JS_DATE_TYPE:
       WriteJSDate(JSDate::cast(*receiver));
       return Just(true);
     case JS_VALUE_TYPE:
@@ skipping 13 matching lines @@
     default:
       UNIMPLEMENTED();
       break;
   }
   return Nothing<bool>();
 }
 
 Maybe<bool> ValueSerializer::WriteJSObject(Handle<JSObject> object) {
   WriteTag(SerializationTag::kBeginJSObject);
   Handle<FixedArray> keys;
-  uint32_t properties_written;
   if (!KeyAccumulator::GetKeys(object, KeyCollectionMode::kOwnOnly,
                                ENUMERABLE_STRINGS)
-           .ToHandle(&keys) ||
-      !WriteJSObjectProperties(object, keys).To(&properties_written)) {
+           .ToHandle(&keys)) {
     return Nothing<bool>();
   }
-  WriteTag(SerializationTag::kEndJSObject);
-  WriteVarint<uint32_t>(properties_written);
+  states_.push_back({State::kJSObjectPropertiesSlow, 0, 0, 0, object, keys});
   return Just(true);
 }
 
 Maybe<bool> ValueSerializer::WriteJSArray(Handle<JSArray> array) {
   uint32_t length = 0;
   bool valid_length = array->length()->ToArrayLength(&length);
   DCHECK(valid_length);
   USE(valid_length);
 
   // To keep things simple, for now we decide between dense and sparse
   // serialization based on elements kind. A more principled heuristic could
   // count the elements, but would need to take care to note which indices
   // existed (as only indices which were enumerable own properties at this point
   // should be serialized).
   const bool should_serialize_densely =
       array->HasFastElements() && !array->HasFastHoleyElements();
 
   if (should_serialize_densely) {
     // TODO(jbroman): Distinguish between undefined and a hole (this can happen
     // if serializing one of the elements deletes another). This requires wire
     // format changes.
     WriteTag(SerializationTag::kBeginDenseJSArray);
     WriteVarint<uint32_t>(length);
-    for (uint32_t i = 0; i < length; i++) {
-      // Serializing the array's elements can have arbitrary side effects, so we
-      // cannot rely on still having fast elements, even if it did to begin
-      // with.
-      Handle<Object> element;
-      LookupIterator it(isolate_, array, i, array, LookupIterator::OWN);
-      if (!Object::GetProperty(&it).ToHandle(&element) ||
-          !WriteObject(element).FromMaybe(false)) {
-        return Nothing<bool>();
-      }
-    }
     KeyAccumulator accumulator(isolate_, KeyCollectionMode::kOwnOnly,
                                ENUMERABLE_STRINGS);
     if (!accumulator.CollectOwnPropertyNames(array, array).FromMaybe(false)) {
       return Nothing<bool>();
     }
     Handle<FixedArray> keys =
         accumulator.GetKeys(GetKeysConversion::kConvertToString);
-    uint32_t properties_written;
-    if (!WriteJSObjectProperties(array, keys).To(&properties_written)) {
-      return Nothing<bool>();
-    }
-    WriteTag(SerializationTag::kEndDenseJSArray);
-    WriteVarint<uint32_t>(properties_written);
-    WriteVarint<uint32_t>(length);
+    states_.push_back(
+        {State::kDenseArrayElementsSlow, 0, length, 0, array, keys});
   } else {
     WriteTag(SerializationTag::kBeginSparseJSArray);
     WriteVarint<uint32_t>(length);
     Handle<FixedArray> keys;
     uint32_t properties_written;
     if (!KeyAccumulator::GetKeys(array, KeyCollectionMode::kOwnOnly,
                                  ENUMERABLE_STRINGS)
-             .ToHandle(&keys) ||
-        !WriteJSObjectProperties(array, keys).To(&properties_written)) {
+             .ToHandle(&keys)) {
       return Nothing<bool>();
     }
-    WriteTag(SerializationTag::kEndSparseJSArray);
-    WriteVarint<uint32_t>(properties_written);
-    WriteVarint<uint32_t>(length);
+    states_.push_back(
+        {State::kSparseArrayPropertiesSlow, 0, length, 0, array, keys});
   }
   return Just(true);
 }
 
 void ValueSerializer::WriteJSDate(JSDate* date) {
   WriteTag(SerializationTag::kDate);
   WriteDouble(date->value()->Number());
 }
 
 Maybe<bool> ValueSerializer::WriteJSValue(Handle<JSValue> value) {
@@ skipping 45 matching lines @@
     int capacity = table->UsedCapacity();
     int result_index = 0;
     for (int i = 0; i < capacity; i++) {
       Object* key = table->KeyAt(i);
       if (key == the_hole) continue;
       entries->set(result_index++, key);
       entries->set(result_index++, table->ValueAt(i));
     }
     DCHECK_EQ(result_index, length);
   }
-
-  // Then write it out.
   WriteTag(SerializationTag::kBeginJSMap);
-  for (int i = 0; i < length; i++) {
-    if (!WriteObject(handle(entries->get(i), isolate_)).FromMaybe(false)) {
-      return Nothing<bool>();
-    }
-  }
-  WriteTag(SerializationTag::kEndJSMap);
-  WriteVarint<uint32_t>(length);
+  states_.push_back({State::kJSMap, 0, 0, 0, map, entries});
   return Just(true);
 }
 
 Maybe<bool> ValueSerializer::WriteJSSet(Handle<JSSet> set) {
   // First copy the element pointers, since getters could mutate them.
   Handle<OrderedHashSet> table(OrderedHashSet::cast(set->table()));
   int length = table->NumberOfElements();
   Handle<FixedArray> entries = isolate_->factory()->NewFixedArray(length);
   {
     DisallowHeapAllocation no_gc;
     Oddball* the_hole = isolate_->heap()->the_hole_value();
     int capacity = table->UsedCapacity();
     int result_index = 0;
     for (int i = 0; i < capacity; i++) {
       Object* key = table->KeyAt(i);
       if (key == the_hole) continue;
       entries->set(result_index++, key);
     }
     DCHECK_EQ(result_index, length);
   }
-
-  // Then write it out.
   WriteTag(SerializationTag::kBeginJSSet);
-  for (int i = 0; i < length; i++) {
-    if (!WriteObject(handle(entries->get(i), isolate_)).FromMaybe(false)) {
-      return Nothing<bool>();
-    }
-  }
-  WriteTag(SerializationTag::kEndJSSet);
-  WriteVarint<uint32_t>(length);
+  states_.push_back({State::kJSSet, 0, 0, 0, set, entries});
   return Just(true);
 }
 
 Maybe<bool> ValueSerializer::WriteJSArrayBuffer(JSArrayBuffer* array_buffer) {
   uint32_t* transfer_entry = array_buffer_transfer_map_.Find(array_buffer);
   if (transfer_entry) {
     DCHECK(array_buffer->was_neutered() || array_buffer->is_shared());
     WriteTag(array_buffer->is_shared()
                  ? SerializationTag::kSharedArrayBufferTransfer
                  : SerializationTag::kArrayBufferTransfer);
@@ skipping 28 matching lines @@
   } else {
     DCHECK(view->IsJSDataView());
     tag = ArrayBufferViewTag::kDataView;
   }
   WriteVarint(static_cast<uint8_t>(tag));
   WriteVarint(NumberToUint32(view->byte_offset()));
   WriteVarint(NumberToUint32(view->byte_length()));
   return Just(true);
 }
 
-Maybe<uint32_t> ValueSerializer::WriteJSObjectProperties(
-    Handle<JSObject> object, Handle<FixedArray> keys) {
-  uint32_t properties_written = 0;
-  int length = keys->length();
-  for (int i = 0; i < length; i++) {
-    Handle<Object> key(keys->get(i), isolate_);
-
-    bool success;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate_, object, key, &success, LookupIterator::OWN);
-    DCHECK(success);
-    Handle<Object> value;
-    if (!Object::GetProperty(&it).ToHandle(&value)) return Nothing<uint32_t>();
-
-    // If the property is no longer found, do not serialize it.
-    // This could happen if a getter deleted the property.
-    if (!it.IsFound()) continue;
-
-    if (!WriteObject(key).FromMaybe(false) ||
-        !WriteObject(value).FromMaybe(false)) {
-      return Nothing<uint32_t>();
-    }
-
-    properties_written++;
-  }
-  return Just(properties_written);
-}
+struct ValueDeserializer::State {
+  enum Kind {
+    kJSObjectProperties,
+    kDenseArrayElements,
+    kDenseArrayProperties,
+    kSparseArrayProperties,
+    kJSMapKey,
+    kJSMapValue,
+    kJSSet,
+  };
+  Kind kind;
+  uint32_t index;
+  uint32_t array_length;
+  uint32_t num_properties;
+  Handle<JSObject> receiver;
+  Handle<Object> elements_or_function;
+  Handle<Object> map_key;
+};
 
 ValueDeserializer::ValueDeserializer(Isolate* isolate,
                                      Vector<const uint8_t> data)
     : isolate_(isolate),
       position_(data.start()),
       end_(data.start() + data.length()),
       id_map_(Handle<SeededNumberDictionary>::cast(
           isolate->global_handles()->Create(
               *SeededNumberDictionary::New(isolate, 0)))) {}
 
@@ skipping 113 matching lines @@
       SeededNumberDictionary::AtNumberPut(dictionary, transfer_id, array_buffer,
                                           used_as_prototype);
   if (!new_dictionary.is_identical_to(dictionary)) {
     GlobalHandles::Destroy(Handle<Object>::cast(dictionary).location());
     array_buffer_transfer_map_ = Handle<SeededNumberDictionary>::cast(
         isolate_->global_handles()->Create(*new_dictionary));
   }
 }
 
 MaybeHandle<Object> ValueDeserializer::ReadObject() {
-  MaybeHandle<Object> result = ReadObjectInternal();
+  size_t stack_size = states_.size();
+  Handle<Object> result;
+  if (!ReadObjectInternal().ToHandle(&result)) return MaybeHandle<Object>();
 
-  // ArrayBufferView is special in that it consumes the value before it, even
-  // after format version 0.
-  Handle<Object> object;
-  SerializationTag tag;
-  if (result.ToHandle(&object) && V8_UNLIKELY(object->IsJSArrayBuffer()) &&
-      PeekTag().To(&tag) && tag == SerializationTag::kArrayBufferView) {
-    ConsumeTag(SerializationTag::kArrayBufferView);
-    result = ReadJSArrayBufferView(Handle<JSArrayBuffer>::cast(object));
+  while (states_.size() > stack_size) {
+    size_t state_index = states_.size() - 1;
+    State& state = states_[state_index];
+    switch (state.kind) {
+      case State::kJSObjectProperties:
+      case State::kDenseArrayProperties:
+      case State::kSparseArrayProperties: {
+        SerializationTag tag;
+        if (!PeekTag().To(&tag)) return MaybeHandle<Object>();
+        const SerializationTag expected_tag =
+            state.kind == State::kDenseArrayProperties
+                ? SerializationTag::kEndDenseJSArray
+                : state.kind == State::kSparseArrayProperties
+                      ? SerializationTag::kEndSparseJSArray
+                      : SerializationTag::kEndJSObject;
+        if (tag == expected_tag) {
+          ConsumeTag(expected_tag);
+          uint32_t expected_num_properties;
+          if (!ReadVarint<uint32_t>().To(&expected_num_properties) ||
+              state.num_properties != expected_num_properties) {
+            return MaybeHandle<Object>();
+          }
+          if (tag != SerializationTag::kEndJSObject) {
+            uint32_t expected_length;
+            if (!ReadVarint<uint32_t>().To(&expected_length) ||
+                state.array_length != expected_length) {
+              return MaybeHandle<Object>();
+            }
+          }
+          states_.pop_back();
+          continue;
+        }
+        state.num_properties++;
+        Handle<Object> receiver = state.receiver;
+        Handle<Object> key;
+        Handle<Object> value;
+        if (!ReadObjectInternal().ToHandle(&key)) return MaybeHandle<Object>();
+        DCHECK_EQ(states_.size(), state_index + 1);
+        if (!ReadObjectInternal().ToHandle(&value)) {
+          return MaybeHandle<Object>();
+        }
+
+        bool success;
+        LookupIterator it = LookupIterator::PropertyOrElement(
+            isolate_, receiver, key, &success, LookupIterator::OWN);
+        if (!success ||
+            JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
+                .is_null()) {
+          return MaybeHandle<Object>();
+        }
+        break;
+      }
+      case State::kDenseArrayElements: {
+        if (state.index >= state.array_length) {
+          DCHECK_EQ(state.index, state.array_length);
+          state.kind = State::kDenseArrayProperties;
+          state.index = 0;
+          continue;
+        }
+        Handle<FixedArray> elements =
+            Handle<FixedArray>::cast(state.elements_or_function);
+        uint32_t index = state.index++;
+        Handle<Object> element;
+        if (!ReadObjectInternal().ToHandle(&element)) {
+          return MaybeHandle<Object>();
+        }
+        // TODO(jbroman): Distinguish between undefined and a hole.
+        if (element->IsUndefined(isolate_)) continue;
+        elements->set(index, *element);
+        break;
+      }
+      case State::kJSMapKey: {
+        SerializationTag tag;
+        if (!PeekTag().To(&tag)) return MaybeHandle<Object>();
+        if (tag == SerializationTag::kEndJSMap) {
+          ConsumeTag(SerializationTag::kEndJSMap);
+          uint32_t expected_length;
+          if (!ReadVarint<uint32_t>().To(&expected_length) ||
+              state.index != expected_length) {
+            return MaybeHandle<Object>();
+          }
+          states_.pop_back();
+          continue;
+        }
+        state.index++;
+        Handle<Object> key;
+        if (!ReadObjectInternal().ToHandle(&key)) return MaybeHandle<Object>();
+        State& new_state = states_[state_index];
+        new_state.kind = State::kJSMapValue;
+        new_state.map_key = key;
+        break;
+      }
+      case State::kJSMapValue: {
+        state.index++;
+        Handle<JSFunction> map_set =
+            Handle<JSFunction>::cast(state.elements_or_function);
+        Handle<JSMap> map = Handle<JSMap>::cast(state.receiver);
+        Handle<Object> argv[2] = {state.map_key, Handle<Object>()};
+        state.kind = State::kJSMapKey;
+        state.map_key = Handle<Object>();
+        if (!ReadObjectInternal().ToHandle(&argv[1]) ||
+            Execution::Call(isolate_, map_set, map, arraysize(argv), argv)
+                .is_null()) {
+          return MaybeHandle<Object>();
+        }
+        break;
+      }
+      case State::kJSSet: {
+        SerializationTag tag;
+        if (!PeekTag().To(&tag)) return MaybeHandle<Object>();
+        if (tag == SerializationTag::kEndJSSet) {
+          ConsumeTag(SerializationTag::kEndJSSet);
+          uint32_t expected_length;
+          if (!ReadVarint<uint32_t>().To(&expected_length) ||
+              state.index != expected_length) {
+            return MaybeHandle<Object>();
+          }
+          states_.pop_back();
+          continue;
+        }
+        state.index++;
+        Handle<JSFunction> set_add =
+            Handle<JSFunction>::cast(state.elements_or_function);
+        Handle<JSSet> set = Handle<JSSet>::cast(state.receiver);
+        Handle<Object> argv[1];
+        if (!ReadObjectInternal().ToHandle(&argv[0]) ||
+            Execution::Call(isolate_, set_add, set, arraysize(argv), argv)
+                .is_null()) {
+          return MaybeHandle<Object>();
+        }
+        break;
+      }
+    }
   }
-
+  DCHECK_EQ(states_.size(), stack_size);
   return result;
 }
 
 MaybeHandle<Object> ValueDeserializer::ReadObjectInternal() {
+  MaybeHandle<Object> result;
   SerializationTag tag;
   if (!ReadTag().To(&tag)) return MaybeHandle<Object>();
   switch (tag) {
     case SerializationTag::kVerifyObjectCount:
       // Read the count and ignore it.
       if (ReadVarint<uint32_t>().IsNothing()) return MaybeHandle<Object>();
-      return ReadObject();
+      result = ReadObject();
+      break;
     case SerializationTag::kUndefined:
       return isolate_->factory()->undefined_value();
     case SerializationTag::kNull:
       return isolate_->factory()->null_value();
     case SerializationTag::kTrue:
       return isolate_->factory()->true_value();
     case SerializationTag::kFalse:
       return isolate_->factory()->false_value();
     case SerializationTag::kInt32: {
       Maybe<int32_t> number = ReadZigZag<int32_t>();
@@ skipping 10 matching lines @@
       if (number.IsNothing()) return MaybeHandle<Object>();
       return isolate_->factory()->NewNumber(number.FromJust());
     }
     case SerializationTag::kUtf8String:
       return ReadUtf8String();
     case SerializationTag::kTwoByteString:
       return ReadTwoByteString();
     case SerializationTag::kObjectReference: {
       uint32_t id;
       if (!ReadVarint<uint32_t>().To(&id)) return MaybeHandle<Object>();
-      return GetObjectWithID(id);
+      result = GetObjectWithID(id);
+      break;
     }
     case SerializationTag::kBeginJSObject:
       return ReadJSObject();
     case SerializationTag::kBeginSparseJSArray:
       return ReadSparseJSArray();
     case SerializationTag::kBeginDenseJSArray:
       return ReadDenseJSArray();
     case SerializationTag::kDate:
       return ReadJSDate();
     case SerializationTag::kTrueObject:
     case SerializationTag::kFalseObject:
     case SerializationTag::kNumberObject:
     case SerializationTag::kStringObject:
       return ReadJSValue(tag);
     case SerializationTag::kRegExp:
       return ReadJSRegExp();
     case SerializationTag::kBeginJSMap:
       return ReadJSMap();
     case SerializationTag::kBeginJSSet:
       return ReadJSSet();
     case SerializationTag::kArrayBuffer:
-      return ReadJSArrayBuffer();
+      result = ReadJSArrayBuffer();
+      break;
     case SerializationTag::kArrayBufferTransfer: {
       const bool is_shared = false;
-      return ReadTransferredJSArrayBuffer(is_shared);
+      result = ReadTransferredJSArrayBuffer(is_shared);
+      break;
     }
     case SerializationTag::kSharedArrayBufferTransfer: {
       const bool is_shared = true;
-      return ReadTransferredJSArrayBuffer(is_shared);
+      result = ReadTransferredJSArrayBuffer(is_shared);
+      break;
     }
     default:
       return MaybeHandle<Object>();
   }
+
+  // ArrayBufferView is special in that it consumes the value before it, even
+  // after format version 0.
+  Handle<Object> object;
+  if (result.ToHandle(&object) && V8_UNLIKELY(object->IsJSArrayBuffer()) &&
+      PeekTag().To(&tag) && tag == SerializationTag::kArrayBufferView) {
+    ConsumeTag(SerializationTag::kArrayBufferView);
+    return ReadJSArrayBufferView(Handle<JSArrayBuffer>::cast(object));
+  }
+
+  return result;
 }
 
 MaybeHandle<String> ValueDeserializer::ReadUtf8String() {
   uint32_t utf8_length;
   Vector<const uint8_t> utf8_bytes;
   if (!ReadVarint<uint32_t>().To(&utf8_length) ||
       utf8_length >
           static_cast<uint32_t>(std::numeric_limits<int32_t>::max()) ||
       !ReadRawBytes(utf8_length).To(&utf8_bytes))
     return MaybeHandle<String>();
@@ skipping 18 matching lines @@
            .ToHandle(&string))
     return MaybeHandle<String>();
 
   // Copy the bytes directly into the new string.
   // Warning: this uses host endianness.
   memcpy(string->GetChars(), bytes.begin(), bytes.length());
   return string;
 }
 
 MaybeHandle<JSObject> ValueDeserializer::ReadJSObject() {
-  // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSObject>();
-
   uint32_t id = next_id_++;
-  HandleScope scope(isolate_);
   Handle<JSObject> object =
       isolate_->factory()->NewJSObject(isolate_->object_function());
   AddObjectWithID(id, object);
-
-  uint32_t num_properties;
-  uint32_t expected_num_properties;
-  if (!ReadJSObjectProperties(object, SerializationTag::kEndJSObject)
-           .To(&num_properties) ||
-      !ReadVarint<uint32_t>().To(&expected_num_properties) ||
-      num_properties != expected_num_properties) {
-    return MaybeHandle<JSObject>();
-  }
-
-  DCHECK(HasObjectWithID(id));
-  return scope.CloseAndEscape(object);
+  states_.push_back({State::kJSObjectProperties, 0, 0, 0, object,
+                     Handle<FixedArray>(), Handle<Object>()});
+  return object;
 }
 
 MaybeHandle<JSArray> ValueDeserializer::ReadSparseJSArray() {
-  // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSArray>();
-
   uint32_t length;
   if (!ReadVarint<uint32_t>().To(&length)) return MaybeHandle<JSArray>();
 
   uint32_t id = next_id_++;
-  HandleScope scope(isolate_);
   Handle<JSArray> array = isolate_->factory()->NewJSArray(0);
   JSArray::SetLength(array, length);
   AddObjectWithID(id, array);
-
-  uint32_t num_properties;
-  uint32_t expected_num_properties;
-  uint32_t expected_length;
-  if (!ReadJSObjectProperties(array, SerializationTag::kEndSparseJSArray)
-           .To(&num_properties) ||
-      !ReadVarint<uint32_t>().To(&expected_num_properties) ||
-      !ReadVarint<uint32_t>().To(&expected_length) ||
-      num_properties != expected_num_properties || length != expected_length) {
-    return MaybeHandle<JSArray>();
-  }
-
-  DCHECK(HasObjectWithID(id));
-  return scope.CloseAndEscape(array);
+  states_.push_back({State::kSparseArrayProperties, 0, length, 0, array,
+                     Handle<FixedArray>(), Handle<Object>()});
+  return array;
 }
 
 MaybeHandle<JSArray> ValueDeserializer::ReadDenseJSArray() {
-  // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSArray>();
-
   uint32_t length;
   if (!ReadVarint<uint32_t>().To(&length)) return MaybeHandle<JSArray>();
 
   uint32_t id = next_id_++;
-  HandleScope scope(isolate_);
   Handle<JSArray> array = isolate_->factory()->NewJSArray(
       FAST_HOLEY_ELEMENTS, length, length, INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE);
   AddObjectWithID(id, array);
 
   Handle<FixedArray> elements(FixedArray::cast(array->elements()), isolate_);
-  for (uint32_t i = 0; i < length; i++) {
-    Handle<Object> element;
-    if (!ReadObject().ToHandle(&element)) return MaybeHandle<JSArray>();
-    // TODO(jbroman): Distinguish between undefined and a hole.
-    if (element->IsUndefined(isolate_)) continue;
-    elements->set(i, *element);
-  }
-
-  uint32_t num_properties;
-  uint32_t expected_num_properties;
-  uint32_t expected_length;
-  if (!ReadJSObjectProperties(array, SerializationTag::kEndDenseJSArray)
-           .To(&num_properties) ||
-      !ReadVarint<uint32_t>().To(&expected_num_properties) ||
-      !ReadVarint<uint32_t>().To(&expected_length) ||
-      num_properties != expected_num_properties || length != expected_length) {
-    return MaybeHandle<JSArray>();
-  }
-
-  DCHECK(HasObjectWithID(id));
-  return scope.CloseAndEscape(array);
+  states_.push_back({State::kDenseArrayElements, 0, length, 0, array, elements,
+                     Handle<Object>()});
+  return array;
 }
 
 MaybeHandle<JSDate> ValueDeserializer::ReadJSDate() {
   double value;
   if (!ReadDouble().To(&value)) return MaybeHandle<JSDate>();
   uint32_t id = next_id_++;
   Handle<JSDate> date;
   if (!JSDate::New(isolate_->date_function(), isolate_->date_function(), value)
            .ToHandle(&date)) {
     return MaybeHandle<JSDate>();
@@ skipping 50 matching lines @@
       !ReadVarint<uint32_t>().To(&raw_flags) ||
       !JSRegExp::New(pattern, static_cast<JSRegExp::Flags>(raw_flags))
            .ToHandle(&regexp)) {
     return MaybeHandle<JSRegExp>();
   }
   AddObjectWithID(id, regexp);
   return regexp;
 }
 
 MaybeHandle<JSMap> ValueDeserializer::ReadJSMap() {
-  // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSMap>();
-
-  HandleScope scope(isolate_);
   uint32_t id = next_id_++;
   Handle<JSMap> map = isolate_->factory()->NewJSMap();
   AddObjectWithID(id, map);
-
-  Handle<JSFunction> map_set = isolate_->map_set();
-  uint32_t length = 0;
-  while (true) {
-    SerializationTag tag;
-    if (!PeekTag().To(&tag)) return MaybeHandle<JSMap>();
-    if (tag == SerializationTag::kEndJSMap) {
-      ConsumeTag(SerializationTag::kEndJSMap);
-      break;
-    }
-
-    Handle<Object> argv[2];
-    if (!ReadObject().ToHandle(&argv[0]) || !ReadObject().ToHandle(&argv[1]) ||
-        Execution::Call(isolate_, map_set, map, arraysize(argv), argv)
-            .is_null()) {
-      return MaybeHandle<JSMap>();
-    }
-    length += 2;
-  }
-
-  uint32_t expected_length;
-  if (!ReadVarint<uint32_t>().To(&expected_length) ||
-      length != expected_length) {
-    return MaybeHandle<JSMap>();
-  }
-  DCHECK(HasObjectWithID(id));
-  return scope.CloseAndEscape(map);
+  states_.push_back(
+      {State::kJSMapKey, 0, 0, 0, map, isolate_->map_set(), Handle<Object>()});
+  return map;
 }
 
 MaybeHandle<JSSet> ValueDeserializer::ReadJSSet() {
-  // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSSet>();
-
-  HandleScope scope(isolate_);
   uint32_t id = next_id_++;
   Handle<JSSet> set = isolate_->factory()->NewJSSet();
   AddObjectWithID(id, set);
-  Handle<JSFunction> set_add = isolate_->set_add();
-  uint32_t length = 0;
-  while (true) {
-    SerializationTag tag;
-    if (!PeekTag().To(&tag)) return MaybeHandle<JSSet>();
-    if (tag == SerializationTag::kEndJSSet) {
-      ConsumeTag(SerializationTag::kEndJSSet);
-      break;
-    }
-
-    Handle<Object> argv[1];
-    if (!ReadObject().ToHandle(&argv[0]) ||
-        Execution::Call(isolate_, set_add, set, arraysize(argv), argv)
-            .is_null()) {
-      return MaybeHandle<JSSet>();
-    }
-    length++;
-  }
-
-  uint32_t expected_length;
-  if (!ReadVarint<uint32_t>().To(&expected_length) ||
-      length != expected_length) {
-    return MaybeHandle<JSSet>();
-  }
-  DCHECK(HasObjectWithID(id));
-  return scope.CloseAndEscape(set);
+  states_.push_back(
+      {State::kJSSet, 0, 0, 0, set, isolate_->set_add(), Handle<Object>()});
+  return set;
 }
 
 MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer() {
   uint32_t id = next_id_++;
   uint32_t byte_length;
   Vector<const uint8_t> bytes;
   if (!ReadVarint<uint32_t>().To(&byte_length) ||
       byte_length > static_cast<size_t>(end_ - position_)) {
     return MaybeHandle<JSArrayBuffer>();
   }
@@ skipping 60 matching lines @@
   }
   if (byte_offset % element_size != 0 || byte_length % element_size != 0) {
     return MaybeHandle<JSArrayBufferView>();
   }
   Handle<JSTypedArray> typed_array = isolate_->factory()->NewJSTypedArray(
       external_array_type, buffer, byte_offset, byte_length / element_size);
   AddObjectWithID(id, typed_array);
   return typed_array;
 }
 
-Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
-    Handle<JSObject> object, SerializationTag end_tag) {
-  for (uint32_t num_properties = 0;; num_properties++) {
-    SerializationTag tag;
-    if (!PeekTag().To(&tag)) return Nothing<uint32_t>();
-    if (tag == end_tag) {
-      ConsumeTag(end_tag);
-      return Just(num_properties);
-    }
-
-    Handle<Object> key;
-    if (!ReadObject().ToHandle(&key)) return Nothing<uint32_t>();
-    Handle<Object> value;
-    if (!ReadObject().ToHandle(&value)) return Nothing<uint32_t>();
-
-    bool success;
-    LookupIterator it = LookupIterator::PropertyOrElement(
-        isolate_, object, key, &success, LookupIterator::OWN);
-    if (!success ||
-        JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
-            .is_null()) {
-      return Nothing<uint32_t>();
-    }
-  }
-}
-
 bool ValueDeserializer::HasObjectWithID(uint32_t id) {
   return id_map_->Has(isolate_, id);
 }
 
 MaybeHandle<JSReceiver> ValueDeserializer::GetObjectWithID(uint32_t id) {
   int index = id_map_->FindEntry(isolate_, id);
   if (index == SeededNumberDictionary::kNotFound) {
     return MaybeHandle<JSReceiver>();
   }
   Object* value = id_map_->ValueAt(index);
@@ skipping 118 matching lines @@
   }
 #endif
   position_ = end_;
 
   if (stack.size() != 1) return MaybeHandle<Object>();
   return scope.CloseAndEscape(stack[0]);
 }
 
 }  // namespace internal
 }  // namespace v8